CVE-2026-19321 is an integer overflow or wraparound vulnerability (CWE-190) in IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. An attacker with service access to the service processor can supply a crafted command to leak contents of hardware registers that should be inaccessible. This could result in limited confidentiality loss and availability impact on the affected host system. The CVSS 3.1 base score is 6.7, reflecting a medium severity with local attack vector, low attack complexity, high privileges required, no user interaction, and scope change.

Successful exploitation can lead to limited confidentiality impacts by leaking sensitive hardware register contents and availability impacts on the affected host system. The attacker must have service access to the service processor, which limits the attack vector to local or privileged users. There is no indication of integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by IBM at this time. Users should monitor IBM advisories for updates and restrict service processor access to trusted personnel only.